waf-http-api/lib/index.d.ts

A CDK construct that fronts an HTTP API with a CloudFront distribution and protects it with AWS WAF.

import { HttpApi } from "aws-cdk-lib/aws-apigatewayv2";
import * as cloudfront from "aws-cdk-lib/aws-cloudfront";
import * as wafv2 from "aws-cdk-lib/aws-wafv2";
import { Construct } from "constructs";
/**
 * @interface WafHttpApiProps
 * @description Properties for the `WafForHttpApi` construct.
 */
export interface WafHttpApiProps {
    /**
     * The HTTP API to be protected by the WAF and CloudFront.
     * This should be an instance of `aws-cdk-lib/aws-apigatewayv2.HttpApi`.
     * @type {HttpApi}
     */
    readonly httpApi: HttpApi;
    /**
     * Optional: Custom WAF rules to apply to the WebACL.
     * If not provided, a default set of AWS Managed Rules will be used,
     * specifically "AWSManagedRulesAmazonIpReputationList" and "AWSManagedRulesCommonRuleSet".
     * These rules help protect against common web exploits and unwanted traffic.
     * @type {wafv2.CfnWebACL.RuleProperty[]}
     * @default AWS Managed Rules (AmazonIpReputationList, CommonRuleSet)
     */
    readonly wafRules?: wafv2.CfnWebACL.RuleProperty[];
}
/**
 * @class WafHttpApi
 * @extends Construct
 * @description A CDK construct that fronts an AWS HTTP API with a CloudFront distribution
 * and protects it with AWS WAF. This enhances security and performance by
 * adding a global CDN layer and web application firewall capabilities.
 * It also injects a secret header from CloudFront to the origin to allow
 * for origin verification by a Lambda Authorizer or similar mechanism.
 */
export declare class WafHttpApi extends Construct {
    /**
     * @static
     * @readonly
     * @property {string} SECRET_HEADER_NAME
     * @description The name of the custom header CloudFront will add to requests
     * forwarded to the origin. This header can be used by your backend (e.g.,
     * a Lambda Authorizer for API Gateway) to verify that the request originated
     * from CloudFront and not directly from the internet.
     */
    static readonly SECRET_HEADER_NAME = "X-Origin-Verify";
    /**
     * @readonly
     * @property {cloudfront.Distribution} distribution
     * @description The CloudFront distribution created and managed by this construct.
     * You can use this property to retrieve the distribution's domain name or ARN.
     */
    readonly distribution: cloudfront.Distribution;
    /**
     * @readonly
     * @property {string} secretHeaderValue
     * @description The randomly generated secret value for the custom header.
     * This value is unique for each deployment of the construct.
     * It should be used in your HTTP API's authorizer or backend logic
     * to validate requests coming through CloudFront.
     */
    readonly secretHeaderValue: string;
    /**
     * @constructor
     * @param {Construct} scope The scope in which to define this construct (e.g., a CDK Stack).
     * @param {string} id The unique identifier for this construct within its scope.
     * @param {WafHttpApiProps} props The properties required to configure this construct,
     * including the target HTTP API and optional WAF rules.
     */
    constructor(scope: Construct, id: string, props: WafHttpApiProps);
    /**
     * @private
     * @method createDefaultRules
     * @description Creates a default set of AWS Managed Rules for the WAF WebACL.
     * These rules provide a good baseline of protection against common threats.
     * @returns {wafv2.CfnWebACL.RuleProperty[]} An array of WAF rule properties.
     */
    private createDefaultRules;
}